diff --git a/backend/app/plugins/wiaas/includes/admin/delivery-process/class-wiaas-admin-delivery-process-flow.php b/backend/app/plugins/wiaas/includes/admin/delivery-process/class-wiaas-admin-delivery-process-flow.php index 7ea3f4d..eae3c91 100644 --- a/backend/app/plugins/wiaas/includes/admin/delivery-process/class-wiaas-admin-delivery-process-flow.php +++ b/backend/app/plugins/wiaas/includes/admin/delivery-process/class-wiaas-admin-delivery-process-flow.php @@ -23,6 +23,15 @@ class Wiaas_Admin_Order_Process_Flow { public static function output_delivery_process() { $order_id = absint( $_GET['id'] ); + $has_access = Wiaas_Access_Management::can_current_user_read_order($order_id); + + if (! $has_access) { + + echo "

You don't have permission to view this order.

"; + + return; + } + $order = wc_get_order($order_id); if ( !$order ) { diff --git a/backend/app/plugins/wiaas/includes/class-wiaas-access-management.php b/backend/app/plugins/wiaas/includes/class-wiaas-access-management.php index 1e323dc..7b6c92d 100644 --- a/backend/app/plugins/wiaas/includes/class-wiaas-access-management.php +++ b/backend/app/plugins/wiaas/includes/class-wiaas-access-management.php @@ -22,6 +22,16 @@ class Wiaas_Access_Management { add_action('wiaas_order_item_installation_assigned', array(__CLASS__, 'assign_order_to_installation_organization'), 10, 3); } + /** + * @param int $order_id + * + * @return bool + */ + public static function can_current_user_read_order($order_id) { + + return Groups_Post_Access::user_can_read_post($order_id); + } + /** * Automatize access control for product and packages *